Eatfuls
Privacy Policy
Who operates Eatfuls
Eatfuls is operated by Linas Lekavicius, Untuliu 28, Vilnius, 11112 Lithuania. For privacy questions or requests, contact linas8@gmail.com. This policy covers the Eatfuls iPhone app and eatfuls.com. Last updated: September 22, 2026.
Your account and food passport
We store your account identifier from Sign in with Apple, username, display name, profile photo, privacy preferences, food photos, diary details, collections, ratings, follows, achievements and points so the service can work across devices. We do not receive your Apple password. Information you submit to support or in a report is used to investigate and respond.
Photos and your library
Camera access is used when you take a photo. The system photo picker lets you choose individual photos. If you enable library scanning, Eatfuls requests Photos permission and looks for food candidates on your device. Library scanning itself does not upload your entire library. Photos you choose to add are uploaded to our service. Photo dates and relevant location metadata may be used to place memories and assess collection eligibility.
AI recognition and verification
With your permission, a photo you choose to recognize or collect is sent through our backend to OpenRouter and the model provider serving Qwen for food recognition and photo verification. Visible details in the photo, including any people or background information, may be included. A generated description of the food is sent to Typesafe AI (Jev) to match it to our food catalog. We do not include your username, Apple sign-in credentials or exact location in these AI requests. OpenRouter requests are configured to use providers that disallow data collection; this is not a guarantee that every provider keeps no operational records. See the OpenRouter and Typesafe AI privacy policies for their handling of submitted data. You can decline AI sharing and continue browsing, or withdraw permission in Settings for future requests. Requests already processed cannot be recalled.
Location
With your permission, we use your location and accuracy at capture time to verify where a food was captured and calculate travel context. Exact coordinates are stored privately and are not shown on public profiles. Country, city and other approximate place information may appear with public activity. You can manage location permission in iOS Settings.
Purchases
Apple processes payments. RevenueCat receives your Eatfuls account identifier and purchase/entitlement information to provide, restore and synchronize Eatfuls Plus access. We do not receive your full payment-card details. Deleting Eatfuls or your account does not cancel an Apple subscription; manage it in your Apple Account subscription settings.
Activity and service security
We collect first-party product-interaction events, such as screens viewed and capture outcomes, to understand and improve Eatfuls. Our infrastructure also processes network and service information, including IP addresses and request/error logs, to deliver the service, diagnose failures and prevent abuse. Apple App Attest helps verify genuine app requests. Push notification tokens are used to deliver notifications you allow. We do not use this data for cross-app advertising tracking or sell personal data.
Who processes data
Cloudflare hosts our API, database, media storage and service logs. Apple provides sign-in, app distribution, payments, device attestation and push delivery. RevenueCat manages purchase entitlements. OpenRouter, its selected model providers, and Typesafe AI process the AI requests described above. These providers may process data in countries other than your own. We may also disclose information when required by law or necessary to protect users and the service.
What other people can see
Your profile visibility controls public access to your profile and eligible activity. Private diary memories and private collections are not public. Sharing a link or exporting a photo can make that content available to its recipients. Avoid including sensitive information or other people without their permission.
Retention, deletion and your choices
Account content is retained to provide your passport until you remove it or delete your account, subject to necessary security, legal and backup retention. Request account deletion in Profile → Settings. The app schedules deletion after a seven-day cancellation period. You can export your data in Settings and contact us for access, correction or deletion requests. Service logs and provider records may have separate retention periods. Applicable law may give you additional rights, including a right to complain to your local data-protection authority.
Changes and contact
We will update this page when our practices change. Contact Linas Lekavicius at linas8@gmail.com for questions about this policy or how your data is handled.
Provider policies: OpenRouter · Typesafe AI · RevenueCat · Cloudflare.